Sonicwall not updating thumbprint databases

You'll experience an issue when Sonicwall Email Security keeps giving errors of stale thumbprints. Trying to force a download of the affected database doesn't work. If you contact Sonicwall tech support they'll have you try and rebuild the databases, most likely using the following commands through SSH:

stop appservices
mysql -dodbrecovery
cleanupdcdatabase

However, after running those commands the thumbprint databases diagnostic page won't show any statistics for the thumbprint databases and won't populate.

This is caused because the Dell Secureworks iSensor IPS/IDS solution somehow changes the update packets going to Sonicwall enough that they fail checksum, and therefore are never applied. Once you remove the iSensor the updates will immediately start working and the thumbprint diagnostic page will start populating.

You'll need to call Secureworks and have them put in an exception for the Sonicwall IPs (mailfrontier.net is the URL). However, white listing them isn't enough, they need to modify the policy to prohibit the iSensor from touching the packets at all; simply white listing will continue to manifest the problem.

Cannot delete account in Exchange

There is an issue where an Activesync device in a user's Exchange account will keep you from deleting the account. However, it errors when you attempt to delete the Activesync device. The trick is to sign into OWA as the user, then delete the devices from there. They'll delete successfully and you can then delete the user.

High CPU on Exchange 2010 Activesync server

If you notice Exchange 2010 Activesync is causing high CPU utilization, this is the procedure to find problem users and disable them.

1. Collect latest logs from \\<Activesync Server>\c$\inetpub\logs\LogFiles\W3SVC1. Be aware the log times are in GMT.

2.  Download MS Log Parser Studio. Load relevant IIS logs.

3. From the library select “Activesync Top 20” and run query. Sort by “Hits”. Ping hits aren’t as damaging as sync hits. Note any which are over 1500 for a 24 hour period.

4. From the library select “Activecyn High RPC Counts or Latency” and run query. Note any high RPC counts.

5. From #3 and #4 you should have a good idea of which users are causing high CPU. Go into Exchange and disable Activesync for those users and on the Activesync server recycle the Activesync App Pool.